CVE-2026-108913

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into /.local/state/omarchy/current/theme may include executable content from an untrusted Git repository...

CVE-2026-108913

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into /.local/state/omarchy/current/theme may include executable content from an untrusted Git repository...

CVE-2026-47763

CVE-2026-47763 affects the Python package manager pdm . In versions prior to 2.27.0, pdm writes several project-local state/config files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets, creating an arbitr...

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

EUVD-2026-45775

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 "batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs" added checks to the local direct TT response code. But the response can also be done...

PYSEC-2026-2862 PDM: Project-Local State and Config Writes Follow Symlinks

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

MAL-2026-10409 Malicious code in cold-debug-elevator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae8ef53b42bfe7f208c404e2e973600fa174f41c5a2009814f5f0e892769195 The package presents itself as a debugging utility but its exported API is a browser credential stealer targeting installer-owned secrets. The...

HdrHistogram: HdrHistogram: Local state issue via 'Count' argument manipulation

A flaw was found in HdrHistogram. A local attacker could exploit this vulnerability by manipulating the 'Count' argument within the recordValueWithCount function. This manipulation leads to a state issue, which could impact the integrity of data processing within the affected component...

Malicious code in @ibrahim1337/baksen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...

HdrHistogram: HdrHistogram: Local state issue via 'Count' argument manipulation

A flaw was found in HdrHistogram. A local attacker could exploit this vulnerability by manipulating the 'Count' argument within the recordValueWithCount function. This manipulation leads to a state issue, which could impact the integrity of data processing within the affected component...

GHSA-GHQ2-5C67-FPRM PDM: Project-Local State and Config Writes Follow Symlinks

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

PDM: Project-Local State and Config Writes Follow Symlinks

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

PT-2026-24172

Summary applySkillConfigEnvOverrides previously copied skills.entries..env values into the host process.env without applying the host env safety policy. Impact In affected versions, dangerous process-level variables such as NODE OPTIONS could be injected when unset, which can influence...

EUVD-2009-4106

Malware in sbrugna...

CVE-2024-37153

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

OESA-2024-1810 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: Action Pack is a framework for handling and responding to web requests. Und...

CVE-2024-37153

The CVE-2024-37153 issue affects Evmos (EVM hub on Cosmos). A vulnerability occurs when a local state change happens together with an ICS20 transfer within the same function, using the contract’s address as the sender in an ICS20 precompile transfer. This enables an effective “infinite money glit...

CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. There is an issue with how to liquid stake using Safe which itself is a contract. The bug only appears when there is a local state change together with an ICS20 transfer in the same function and uses the contract's balance, that...

OPENSUSE-SU-2023:0297-1 Security update for opera

This update for opera fixes the following issues: - Update to 103.0.4928.16 CHR-9416 Updating Chromium on desktop-stable- branches CHR-9433 Update Chromium on desktop-stable-117-4928 to 117.0.5938.89 CHR-9449 Update Chromium on desktop-stable-117-4928 to 117.0.5938.132 DNA-110337 Opera Intro...